The ID seems to persist between sessions so it shouldn't change while you're playing, but of course you'll need to do some testing to make sure.

Also, after some brief testing with a Bag of Shiny Things, the GUID from GetLootSourceInfo is completely unrelated to the player's GUID (0x4480000418D9CC0B for the bag and 0x0480000002D6F631 for the player). It's also not the GUID of the unit that gave me the item as a quest reward, so I'm not sure what it represents.

It's possible the containers you were checking were created by the player and retained that information for a while before being discarded by the server.